by Kastro
Paper/Archive/CVE-2020-6262

CVE-2020-6262

SAP SE SAP Application Server ABAP (ST-PI) — Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710,…

EPSS 1%CVSS 9.9
critical.is priorityof 100
43
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 67.5.675 × 2013.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.

Affected

ProductAffectedFixed inSource
SAP Application Server ABAP (ST-PI)< 2008_1_46C–CNA
SAP Application Server ABAP (ST-PI)< 2008_1_620–CNA
SAP Application Server ABAP (ST-PI)< 2008_1_640–CNA
SAP Application Server ABAP (ST-PI)< 2008_1_700–CNA
SAP Application Server ABAP (ST-PI)< 2008_1_710–CNA
SAP Application Server ABAP (ST-PI)< 740–CNA

Scores by source

sap (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222reflaunchpad.support.sap.com/#/notes/2835979